All Apps and Add-ons

Restrict search for specific index in Windows App

vad34
Path Finder

Hello All!
I need to restrict specific index/indexes in Windows App
I able to do it with specific indexes after i set restrictions in authorize.conf
what file do i have to modify to accomplish it?
Tnx
Vadim

0 Karma

bpadmanbhachari
Splunk Employee
Splunk Employee

Not very clear on the question, however in authorize.conf we have few parameter to restrict the index from viewing for specific roles. You can actually refer below doc for more information.

https://docs.splunk.com/Documentation/Splunk/7.2.5/Security/Addandeditroleswithauthorizeconf#Search_... and also, you can refer below splunk answer for reference.
https://answers.splunk.com/answers/672165/how-to-build-a-srchfilter-when-two-indexes-are-all.html

0 Karma

mreynov_splunk
Splunk Employee
Splunk Employee

authorize.conf it is. what is the question again?

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

Industry Solutions for Supply Chain and OT, Amazon Use Cases, Plus More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...